This vulnerability (CVE-2026-54811) involves improper neutralization of special elements used in SQL commands (CWE-89) in the WP eMember plugin before version 10.9.4. It allows unauthenticated attackers to perform SQL Injection attacks, which can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). The vulnerability is publicly known but no exploits are currently reported in the wild. No official fix or remediation level has been published by the vendor as of now.

Successful exploitation can lead to unauthorized access to sensitive data stored in the database due to SQL Injection. The confidentiality impact is high, as attackers can retrieve data without authentication. Integrity impact is not indicated, and availability impact is low, possibly causing partial service disruption. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin functionality and monitor for suspicious activity. Avoid exposing the vulnerable plugin to untrusted users. Apply the update to version 10.9.4 or later as soon as it becomes available.